top provides a repeatedly updated view of system activity and running processes. It is useful for forming a performance hypothesis, but a busy sample alone does not prove the cause of a problem. Compare several updates and correlate them with logs and workload-specific metrics.
Process Utilization · Lesson 1
Tracking processes: top
Learn how to use top to interpret system load, CPU, memory, and per-process activity.
Reading the System Summary
A typical display begins with summary lines followed by a process table:
top - 18:06:26 up 6 days, 4:07, 2 users, load average: 0.92, 0.62, 0.59
Tasks: 389 total, 1 running, 387 sleeping, 0 stopped, 1 zombie
%Cpu(s): 1.8 us, 0.4 sy, 0.0 ni, 97.6 id, 0.1 wa, 0.0 hi, 0.0 si, 0.0 st
MiB Mem : 32099.0 total, 5276.3 free, 7031.2 used, 19791.5 buff/cache
MiB Swap: 32700.0 total, 32661.0 free, 39.0 used
The first line contains the current time, uptime, logged-in user count, and 1-, 5-, and 15-minute load averages. The task line counts process states. Load average is not a direct CPU percentage; on Linux it reflects runnable tasks and tasks in uninterruptible sleep, so interpret it alongside CPU count, I/O activity, and latency.
What do the three load-average values in top represent?
Interpreting CPU Time
Common CPU fields include:
us: user-space execution time.sy: kernel execution time.ni: user-space time for niced tasks.id: idle time.wa: idle time while an outstanding I/O request exists.hiandsi: hardware- and software-interrupt handling.st: virtual CPU time taken by the hypervisor for other guests.
A high wa value can support an I/O-wait hypothesis, but it does not identify a device or prove that storage is the only bottleneck. Inspect device latency and application behavior before concluding.
What does the wa CPU field report?
Reading the Process Table
Important columns commonly include:
PID,USER, andCOMMAND: identity and ownership.S: state such as running (R), sleeping (S), uninterruptible sleep (D), stopped (T), or zombie (Z).%CPUand%MEM: sampled CPU activity and share of physical memory.TIME+: accumulated CPU time.VIRT: total virtual address space associated with the task.RES: resident, non-swapped physical memory currently attributed to it.SHR: resident memory that may be shared with other processes.
VIRT is not the amount of physical RAM consumed. It can include mapped files, shared libraries, reserved address space, and swapped pages. Even RES should be interpreted carefully because shared pages complicate attribution.
Which field is closer to a process's currently resident physical memory?
Focusing and Sorting
Monitor known PIDs directly:
$ top -p 1234,5678
Inside top, press P to sort by CPU, M to sort by memory, 1 to toggle per-CPU lines, and q to quit on common procps-ng implementations. Press h for the local interactive help because keys and fields can differ by implementation.
Record the PID, command, timestamp, and several samples before taking action. A process briefly reaching the top can be normal, and terminating it can cause data loss or an outage.
Which invocation limits the display to PID 1234?
Lesson complete
You finished Tracking processes: top
You can now use top to build and test a system-performance hypothesis.
Read load averages as time-windowed load, not CPU percentages.
Compare CPU categories across multiple samples.
Distinguish virtual address space from resident memory.
Focus on known PIDs and verify evidence before acting.
Keep your learning progress
Create a free account to save this lesson and continue learning on any device.
Create a free account